# =============================================================
# URL Database System — .htaccess
# Compatible with Apache 2.2, Apache 2.4, and LiteSpeed (LSWS).
#
# If you still get a 500 error after uploading this, comment out
# blocks one at a time (starting from the bottom) to find the
# directive your host doesn't accept. See INSTALL.md.
# =============================================================

# --- Block sensitive files ----------------------------------
# Wrapped so it works on both Apache 2.2 (Order/Deny) and 2.4
# (Require). mod_authz_core is loaded on 2.4 only.
<Files "config.php">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</Files>
<Files "config.example.php">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</Files>
<Files "database.sql">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</Files>
<Files "import_cli.php">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</Files>
<FilesMatch "\.(md|sql|log)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order allow,deny
        Deny from all
    </IfModule>
</FilesMatch>

# --- URL rewriting ------------------------------------------
<IfModule mod_rewrite.c>
    RewriteEngine On

    # Root URL "/" => public/index.html
    RewriteRule ^$ public/index.html [L]

    # Leave /api/* alone (PHP endpoints).
    RewriteRule ^api/ - [L]

    # Block direct browsing of /public/ — redirect to clean URL.
    RewriteCond %{THE_REQUEST} \s/+public/ [NC]
    RewriteRule ^public/(.*)$ /$1 [R=301,L]

    # Serve missing root paths from public/ (style.css, app.js, etc.)
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule ^(.*)$ public/$1 [L]
</IfModule>

# PHP runtime settings live in .user.ini instead of php_value
# directives here — that approach works under mod_php, FastCGI,
# PHP-FPM, suPHP, and LiteSpeed's LSAPI.
